feat(files): gate files. browse behind FILES_BROWSE (on|off)

Per-host toggle for the read-only, no-auth browse of the shared upload dir,
so it can stay on for the LAN-party host (oxps) and be off on the
internet-facing one (cochi). Defaults to `on` — existing hosts unchanged.

Neither layer has conditionals, so each gets the value substituted in:
- caddy: docker-compose mounts 62-files.${FILES_BROWSE:-on}.caddy at the
  fixed conf.d target (62-files.caddy -> 62-files.on.caddy, plus a
  comments-only 62-files.off.caddy stub — caddy needs a parseable file
  there). Same trick as FILES_MOUNT_MODE.
- nginx: render-nginx.sh splices nginx/files-browse.server.tmpl into
  ${FILES_BROWSE_SERVER} and adds/omits the name in the port-80 redirect.
  This is the gate that matters; caddy is bound to 127.0.0.1.

Applying a change needs render-nginx.sh --install plus a caddy
--force-recreate (single-file bind mount pins the inode). With `off`,
drop `files` from LE_SUBDOMAINS on that host. upload. is unaffected.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.env.example

@@ -64,6 +64,17 @@ FILES_DATA_DIR=/srv/ulicraft-files
 # value is substituted straight into the volume string.
 FILES_MOUNT_MODE=rw
 
+# files.${BASE_DOMAIN} — the read-only, NO-AUTH browse of the same share.
+# Per-host toggle, `on` | `off` (default on). It gates two layers, both reading
+# this var: the caddy vhost (docker-compose.yml substitutes the value into the
+# conf.d mount path — 62-files.on.caddy vs the 62-files.off.caddy stub) and the
+# public nginx vhost (tooling/render-nginx.sh). `off` also drops the name from
+# the port-80 redirect, so no cert is needed — drop `files` from LE_SUBDOMAINS
+# too on that host. upload. (filestash, authenticated) is NOT affected.
+# After changing it: tooling/render-nginx.sh --install
+#                    docker compose up -d --force-recreate caddy
+FILES_BROWSE=on
+
 # Runtime uid:gid of the filestash process (docker `user:`). Leave at the image
 # default 1000:1000 UNLESS you want files it writes into the share owned by a
 # host account. To own the share as `oier` on oxps: set both to 1002 and run